
What is claimed is: 

1 . A method for scanning data, comprising: 

receiving an electronic document; 

determining the electronic document is an archive file; 
5 applying risk-assessment heuristics to the electronic document to 

determine a risk factor for scanning the electronic document; 

assigning a scanning priority to the electronic document based at least in 
part on the risk factor, said scanning priorities including low scanning priority, normal 
scanning priority, and discard without scanning; and 

□ 10 scanning the electronic document according to the scanning priority. 
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fjf 2. The method of claim 1 , further comprising: 

j=j! receiving an E-mail having the electronic document as an attachment; 

J" inspecting, as part of said scanning the electronic document, for viruses. 
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flj 3. The method of claim 1 , further comprising: 

□ selecting a scanning thread, from plural scanning threads having 
associated thread execution priorities, having an execution priority at least as high as 
said assigned scanning priority; and 

20 assigning performance of said scanning the electronic document to said 

selected scanning thread. 

4. The method of claim 3, further comprising: 

disposing the method within a multi-processor computing device; 
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designating a first processor to process at least low scanning priority 

threads; and 

assigning said selected scanning thread to the first processor. 

5 5. The method of claim 1 , wherein risk-assessment comprises: 

determining if the electronic document is an archive containing files; and 
if so, then a selected one of determining if the archive contains a sub- 
archive, determining if an aggregate de-archived size for said files exceeds a first 
threshold, determining if a file count of said files exceeds a second threshold, or 
10 determining if a file-type count of said files exceeds a third threshold. 
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Q] 6. The method of claim 5, wherein the first threshold is 10 megabytes, 

U! the second threshold is 50 files, and the third threshold is 10 file types. 
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"MS 7. The method of claim 1 , further comprising: 

'Z* determining if electronic document is an archive containing files; 

if so, then determining if an aggregate de-archived size for said files 
exceeds a first threshold; 

if so, then determining if the aggregate de-archived size exceeds a disk 
20 space threshold; and 

if so, then setting the scanning priority of the electronic document to low 
scanning priority. 

8. The method of claim 1 , further comprising: 
25 determining if electronic document is an archive containing files; 
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if so, then determining if an aggregate de-archived size for said files 
exceeds a first threshold; 

if so, then determining if a volatile memory requirement for scanning the 
archive exceeds a memory requirement threshold; and 

if so, then setting the scanning priority of the electronic document to low 
scanning priority. 

9. The method of claim 1 , further comprising: 

first determining if the electronic document is an archive containing files; 

second determining if at least one file of the archive is a sub-archive; 

third determining if an aggregate de-archived size for the archive exceeds 
a disk space threshold; 

fourth determining if a file count for the archive of said files exceeds a file 
count threshold; and 

if each of said first, second, third and fourth determining evaluate true, 
then setting the scanning priority of the electronic document to discard without 
scanning. 

10. The method of claim 1 , in which the electronic document either is 
an archive, or contains the archive, the method further comprising: 

determining the archive contains at least one sub-archive therein; 
determining if the archive contains a large number of files; and 
determining if an un-archived size for the archive exceeds a 
predetermined size limit; and 
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assigning the scanning priority to be discard without scanning if the 
archive contains a large number of files, and the un-archived size for the archive 
exceeds the predetermined size limit. 

5 11. The method of claim 1 0, wherein if the un-archived size for the 

archive does not exceed the predetermined size limit, or the archive does not contain 
the large number of files, the method further comprising: 

assigning the scanning priority to be low scanning priority. 

10 12. The method of claim 1 , in which the electronic document either is 

P1 an archive, or contains the archive, the method further comprising: 
m determining if an un-archived size for the archive exceeds a size limit; 

U! determining if a memory requirement for performing said scanning the 

W electronic document exceeds a memory limit; and 

^ 15 assigning the scanning priority to be discard without scanning if the un- 

J/f archived size for the archive exceeds the size limit, and the memory requirement for 

~ performing said scanning the electronic document exceeds the memory limit. 
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1 3. The method of claim 1 2, wherein if the memory requirement for 
20 performing said scanning the electronic document does not exceed the memory limit, 
the method further comprising: 

assigning the scanning priority to be low scanning priority. 
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14. An article of manufacture comprising a readable medium having 
instructions encoded thereon, which when executed by a processor, are capable of 
directing the processor to perform the operations of claim 1. 

5 15. The medium of claim 14, said programming instructions including 

further instructions to direct the processor to perform the operations of claim 2. 

16. The medium of claim 14, said programming instructions including 
further instructions to direct the processor to perform the operations of claim 3. 

10 

17. The medium of claim 16, said programming instructions including 
% further instructions to direct the processor to perform the operations of claim 4. 
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yi 18. The medium of claim 14, said programming instructions including 

UJ1 5 further instructions to direct the processor to perform the operations of claim 5. 

p 9 19. The medium of claim 18, said programming instructions including 

■S3 : 

Lj^ further instructions to direct the processor to perform the operations of claim 6. 

""20 20. The medium of claim 14, said programming instructions including 

further instructions to direct the processor to perform the operations of claim 7. 

21. The medium of claim 14, said programming instructions including 
further instructions to direct the processor to perform the operations of claim 8. 
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22. The medium of claim 14, said programming instructions including 
further instructions to direct the processor to perform the operations of claim 9. 
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23. The medium of claim 14, said programming instructions including 
further instructions to direct the processor to perform the operations of claim 10. 

24. The medium of claim 23, said programming instructions including 
further instructions to direct the processor to perform the operations of claim 1 1 . 

25. The medium of claim 14, said programming instructions including 
further instructions to direct the processor to perform the operations of claim 12. 

26. The medium of claim 25, said programming instructions including 
further instructions to direct the processor to perform the operations of claim 13. 
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